On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:> Hi Team, > > > I have enabled full_audit logging on a (domain-member) file-server > (running 4.15.7 from Louis on Bullseye) > > [global] > log level = 3 > full_audit:success = pwrite write renameThere have been changes, try replacing 'rename' with 'renameat'. I think what is happening is that because 'rename is now an error, it is defaulting to 'all'. Rowland
Op 15-06-2022 om 18:12 schreef Rowland Penny via samba:> On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote: >> Hi Team, >> >> >> I have enabled full_audit logging on a (domain-member) file-server >> (running 4.15.7 from Louis on Bullseye) >> >> [global] >> log level = 3 >> full_audit:success = pwrite write rename > There have been changes, try replacing 'rename' with 'renameat'. > I think what is happening is that because 'rename is now an error, it > is defaulting to 'all'. > > Rowland > >Thanks Rowland, that is indeed the case. Issue solved! Strangely enough 'smbcontrol all reload-config' was not enough to change it, I had to restart smbd to activate the changed config item. - Kees
On Wed, Jun 15, 2022 at 05:12:45PM +0100, Rowland Penny via samba wrote:>On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote: >> Hi Team, >> >> >> I have enabled full_audit logging on a (domain-member) file-server >> (running 4.15.7 from Louis on Bullseye) >> >> [global] >> log level = 3 >> full_audit:success = pwrite write rename > >There have been changes, try replacing 'rename' with 'renameat'. >I think what is happening is that because 'rename is now an error, it >is defaulting to 'all'.We should probably just log a debug message about the unknown name and then ignore the unknown name instead of going full "ALL" on the audit. Rowland, can you log a bug on this so we can track getting a fix. This problem keeps coming up and is a pain point for users. Thanks ! Jeremy.